-----Original Message-----
From: Rolf E. Sonneveld
[mailto:R(_dot_)E(_dot_)Sonneveld(_at_)sonnection(_dot_)nl]
Sent: Friday, May 06, 2011 8:12 AM
To: John R. Levine
Cc: Murray S. Kucherawy; ietf-dkim(_at_)mipassoc(_dot_)org
Subject: Re: [ietf-dkim] l= statistics was 23 again (sorry John) was Output
John, the opendkim project gathers information from various sources,
they're not necessarily the users of Murray and they're not necessarily
subscribed to mailing lists. The statistics also doesn't tell which
inbound mail is from legitimate sources and which inbound mail is from
spammers/bad guys. Maybe the 95% you mention, are the spammers who try
to abuse l= in DKIM...
Correlation against Spamassassin results is possible, though the data set is
more limited because only a few reporting hosts include that extended data.
I'm not sure what this tells you but here it is:
+------------+------+------+
| l= present | pass | spam |
+------------+------+------+
| 4902 | 0 | 0 |
| 307 | 0 | 1 |
| 49265 | 1 | 0 |
| 775 | 1 | 1 |
+------------+------+------+
+------+------+------+
| l=0 | pass | spam |
+------+------+------+
| 3357 | 0 | 0 |
| 305 | 0 | 1 |
| 3386 | 1 | 0 |
| 14 | 1 | 1 |
+------+------+------+
+--------------+------+------+
| l= < msgsize | pass | spam |
+--------------+------+------+
| 4819 | 0 | 0 |
| 307 | 0 | 1 |
| 43539 | 1 | 0 |
| 768 | 1 | 1 |
+--------------+------+------+
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html